1. Field of the Invention
The present invention relates to security in the data networks, and more particularly to the authentication of sources of data carrying a medium access control (MAC) layer address as a source address.
2. Description of Related Art
Many common data networks are inherently insecure. For example, Ethernet based networks involve local area network LAN segments in which every end station on a given segment is capable of reading every packet sent to any other end station on that given segment. In general, each end station in the network has a unique MAC address, and an end station reads packets on the transmission medium to determine whether they carry its unique MAC address as a destination. However, it is possible that end stations operate in a promiscuous mode, reading every packet on the transmission medium, or every packet that carries a class of MAC addresses which the end station is setup to read. For example, during configuration or debugging operations, network adapters are placed in the promiscuous mode, to read every packet on the transmission medium and pass such packets up the protocol stack for further processing.
However, promiscuous mode operation can also be used by an end station to read and examine all of the network traffic, and bypass the normal addressing in the network. This allows an end station on the network to read data that is not intended for it.
A related security problem involves end stations on the network sending outgoing packets carrying the MAC address of another end station as a source address in the packet. This allows one end station to mimic the other in a way often referred to as spoofing. Security problems arise from this mimic behavior, because for example, the source address of the packet is used as a basis for identifying participants in the network by many protocols. Network devices learn the segments of the network on which to find certain MAC addresses. Thus, by using the MAC address of another device, an end station is capable of fooling the network so that packets destined to the end station that it is mimicking, are routed to the mimic. Also, an unscrupulous user spoofing another packet can introduce unwanted data such as computer viruses into a packet stream being transmitted from the end station, or hijack a user's network session and gain unauthorized access to other system resources.
There are however, some times when an end station or other network device will want to legitimately send out a packet with a different MAC address. As one example, on Ethernet there is a concept known as transparent bridging in which an end station acts as a transparent forwarder of packets for other end stations. In some prior art systems, an adapter can take the source address from a register and insert it into a packet in order to force the MAC address.
A number of techniques have been proposed or implemented to thwart the spoofing of MAC addresses. These techniques rely on the use of look-up tables in intermediate stations, that are configured with the MAC address of authorized end stations, and mapped to particular ports on those devices. If a MAC address arrives on a port other than the port for which it has been configured, then that data packet is rejected. See, for example, U.S. Pat. No. 5,161,192 entitled REPEATERS FOR SECURE LOCAL AREA NETWORKS by Carter, et al. These prior art approaches do not detect use of a MAC address by an unauthorized sender, but rather assume that any packet carrying the correct MAC address is the authentic source of that address. Without authentication of a sender of a packet, these prior art measures can be thwarted.
Authentication of sender of data has been proposed in the prior art for higher protocol layers, such as the Internet Protocol IP layer, or in higher layers. For example, the Point-to-Point Protocol challenge handshake authentication protocol CHAP establishes a technique in the PPP protocol during establishment of a link by which the participants in the session can be authenticated. See, RFC 1994, "PPP Challenge Handshake Authentication Protocol", August 1996; see IPSEC RFCs 1825, 1826, 1827; see also ITU-T Recommendation X.509, November 1993. Of course these approaches have a disadvantage that they only operate for data packets operating under specific higher layer protocols. Many data packets in the system are used for processes which operate only at the lower layers. Such packets are able to bypass the authentication processes that the higher layer protocols execute, and introduce security risks into the network.
It is desirable to provide a more robust system for preventing the spoofing of MAC addresses in a data network. It is desirable that the system be self configuring, and have little or no impact on the host processor in which the protection is implemented. In many environments it is desirable to authenticate that the source of a packet carrying a MAC address, is in fact the end station to which that MAC address has been assigned. If this authentication can be carried out, many of the insecurities introduced by the spoofing techniques could be reduced.
Accordingly, it is desirable to provide for authentication of sources of packets at the lowest network layer possible.